Raspberry Robin Scenario: Community First Bank Network

Community First Bank: Regional bank with 45 branch locations, 1,200 employees
Worm • RaspberryRobin
STAKES
Customer financial data + Banking operations + Regulatory compliance + Financial transaction security
HOOK
Community First Bank is processing peak month-end transactions when branch managers report USB drives used for daily transaction reconciliation and audit procedures are creating suspicious folder-like files. The USB malware is spreading through routine banking workflows, affecting customer account systems, transaction processing, and financial audit networks through legitimate USB procedures used across branch locations.
PRESSURE
Month-end transaction processing - banking system failures affect customer accounts + Financial regulatory compliance at risk
FRONT • 120 minutes • Advanced
Community First Bank: Regional bank with 45 branch locations, 1,200 employees
Worm • RaspberryRobin
NPCs
  • Regional Director Janet Foster: Managing month-end operations across 45 branches while USB malware spreads through banking networks affecting customer transaction processing
  • IT Security Manager Carlos Martinez: Investigating USB-based worm propagation through banking workflows bypassing financial network security
  • Branch Operations Manager Diana Chen: Reporting infected USB drives affecting daily transaction reconciliation and customer account systems
  • Compliance Officer Robert Kim: Assessing potential customer data exposure and regulatory notification requirements as USB malware spreads through financial systems
SECRETS
  • Bank employees routinely use USB drives for transaction reconciliation, audit procedures, and data transfer between branch locations
  • USB malware exploits legitimate banking workflows to spread between customer account systems and financial transaction networks
  • Infected systems include customer account databases, transaction processing, and financial audit systems

Planning Resources

Tip📋 Comprehensive Facilitation Guide Available

For detailed session preparation support, including game configuration templates, investigation timelines, response options matrix, and round-by-round facilitation guidance, see:

Raspberry Robin Financial Branch Offices Planning Document

Planning documents provide 30-minute structured preparation for first-time IMs, or quick-reference support for experienced facilitators.

Note🎬 Interactive Scenario Slides

Ready-to-present RevealJS slides with player-safe mode, session tracking, and IM facilitation notes:

Raspberry Robin Financial Branch Offices Scenario Slides

Press ‘P’ to toggle player-safe mode • Built-in session state tracking • Dark/light theme support

Scenario Details for IMs

Community First Bank: Regional Banking Network During USB-Driven Transaction Processing

Quick Reference

  • Organization: Regional bank with 45 branch locations, 1,200 employees processing customer financial transactions
  • Key Assets at Risk: Customer financial data across branch network, Banking operations and transaction processing systems, Financial regulatory compliance, Transaction security
  • Business Pressure: Month-end transaction processing peak operations—banking system failures affect customer accounts, financial regulatory compliance at risk during critical processing window
  • Core Dilemma: Continue USB-based transaction reconciliation maintaining banking operations BUT allows malware propagation through customer account systems, OR Halt USB use for containment BUT disrupts transaction processing and audit procedures affecting customer services
Detailed Context
Organization Profile

Regional bank with 45 branch locations, 1,200 employees

Key Assets At Risk: - Customer financial data - Banking operations - Regulatory compliance - Financial transaction security

Business Pressure
  • Month-end transaction processing - banking system failures affect customer accounts
  • Financial regulatory compliance at risk
Cultural Factors
  • Bank employees routinely use USB drives for transaction reconciliation, audit procedures, and data transfer between branch locations
  • USB malware exploits legitimate banking workflows to spread between customer account systems and financial transaction networks
  • Infected systems include customer account databases, transaction processing, and financial audit systems

Hook

“It’s the last business day of the month at Community First Bank, and all 45 branch locations are processing peak transaction volumes for month-end reconciliation. Branch managers across the network are reporting that USB drives used for daily audit procedures and transaction data transfers are behaving strangely - creating mysterious folder-like files that spread to every system they touch. The USB-based worm is propagating through routine banking workflows, affecting customer account systems and financial transaction networks. Federal banking regulators require immediate notification of any customer data compromise.”

Initial Symptoms to Present:

Warning🚨 Initial User Reports
  • “USB drives used for branch reconciliation automatically creating suspicious LNK files disguised as folders”
  • “Transaction processing systems showing signs of infection spreading through USB-based audit procedures”
  • “Multiple branch locations reporting similar USB malware symptoms across the banking network”
  • “Customer account databases accessed by infected USB drives during routine data transfer procedures”

Key Discovery Paths:

Detective Investigation Leads:

  • Forensic analysis reveals USB worm using LNK file exploitation to spread through banking workflows
  • Branch audit trail shows USB malware propagation through legitimate transaction reconciliation procedures
  • Investigation timeline reveals malware spreading rapidly between customer account and transaction processing systems

Protector System Analysis:

  • Banking network monitoring reveals USB-based worm bypassing network security through physical media
  • Customer account system security analysis shows widespread infection across branch locations
  • Financial transaction processing assessment reveals potential compromise of banking operational networks

Tracker Network Investigation:

  • USB device tracking reveals malware spreading through routine branch audit and reconciliation procedures
  • Banking workflow analysis shows worm exploiting legitimate financial data transfer processes
  • Network propagation mapping reveals infection spreading across all 45 branch locations through USB workflows

Communicator Stakeholder Interviews:

  • Branch managers describe routine USB procedures for transaction reconciliation and audit compliance
  • Banking operations staff explain daily data transfer workflows that may have spread the infection
  • Compliance officers describe federal banking regulations requiring customer data breach notification

Mid-Scenario Pressure Points:

Evolution Triggers:

Resolution Pathways:

Technical Success Indicators:

Business Success Indicators:

Learning Success Indicators:

Common IM Facilitation Challenges:

If Banking Regulatory Complexity Is Overwhelming:

“The federal banking regulations are detailed, but the core requirement is simple: if customer account data was accessed by malware, you must notify regulators and affected customers within specific timeframes. Focus on determining what data was compromised.”

If USB Workflow Exploitation Is Underestimated:

“Carlos just confirmed that every branch uses USB drives for daily transaction reconciliation - it’s required by your audit procedures. The malware is spreading through your most routine and trusted banking workflows. How do you stop a worm that travels through your standard operating procedures?”

If Multi-Branch Coordination Is Missed:

“Janet reports that infected USB drives have been used at 35 different branch locations in the past week. Each branch shares USB audit procedures with multiple other branches. How do you coordinate USB malware response across a distributed banking network?”

Success Metrics for Session:

Template Compatibility

This scenario adapts to multiple session formats with appropriate scope and timing:

Quick Demo (35-40 minutes)

Structure: 3 investigation rounds, 1 decision round Focus: Core USB worm discovery and immediate banking network containment Simplified Elements: Streamlined regulatory compliance and multi-branch coordination complexity Key Actions: Identify USB malware propagation, implement emergency device controls, coordinate branch notification

Lunch & Learn (75-90 minutes)

Structure: 5 investigation rounds, 2 decision rounds Focus: Comprehensive USB workflow investigation and customer data protection Added Depth: Federal banking regulation requirements and transaction processing security Key Actions: Complete forensic analysis of USB worm spread, coordinate regulatory notification, restore banking operations with verification

Full Game (120-140 minutes)

Structure: 7 investigation rounds, 3 decision rounds Focus: Complete multi-branch USB outbreak response with federal regulatory coordination Full Complexity: Customer data breach assessment, federal examiner coordination, long-term USB security policy development Key Actions: Comprehensive USB malware containment across 45 branches, coordinate federal compliance response, implement enhanced banking workflow security

Advanced Challenge (150-170 minutes)

Structure: 8-9 investigation rounds, 4 decision rounds Expert Elements: Banking regulatory technical depth, multi-branch coordination complexity, customer notification strategy Additional Challenges: Mid-scenario month-end deadline pressure, federal examiner inspection, customer data forensics complexity Key Actions: Complete investigation under banking operational constraints, coordinate multi-branch and federal response, implement comprehensive USB security architecture while maintaining transaction processing

Quick Demo Materials (35-40 min)

Guided Investigation Clues

Progressive hints to maintain engagement and learning momentum:

If team is uncertain where to start investigation:

“Branch Operations Manager Diana Chen has been tracking the infection spread. She’s discovered that the USB malware is propagating through the bank’s required audit procedures - every branch uses USB drives to transfer daily transaction reconciliation data to regional offices, and these same USB drives are used at multiple branches throughout the week. The worm exploits your most routine and trusted banking workflow. What does this tell you about how to contain the spread?”

Teaching moment: USB-based malware can exploit legitimate business workflows, spreading through trusted procedures that bypass network security. Containment requires understanding and temporarily modifying operational workflows, not just technical fixes.

If team misses regulatory notification implications:

“IT Security Manager Carlos has completed his analysis of infected systems. The USB malware accessed customer account databases at 35 branch locations, potentially exposing account numbers, transaction histories, and personal information for approximately 125,000 customers. Federal banking regulations require breach notification to regulators within 24 hours and to affected customers within 30 days. How does this regulatory timeline change your response priorities?”

Teaching moment: Financial sector cybersecurity incidents trigger specific federal regulatory requirements with strict timelines. Response must balance technical remediation with compliance obligations and customer notification procedures.

If team overlooks distributed network coordination:

“Regional Director Janet has reviewed branch audit schedules. USB drives rotate between branch locations on a weekly cycle - a drive infected at one branch on Monday could visit four other branches by Friday, spreading malware at each location which then infects additional drives used locally. You’re not facing one infection - you’re facing a cascading multi-branch outbreak that spreads faster than traditional network worms because it bypasses network security entirely. How do you coordinate containment across 45 distributed locations with varied USB usage patterns?”

Teaching moment: USB malware in distributed organizations creates unique containment challenges requiring coordination across multiple locations, operational workflow modification, and simultaneous response execution to prevent reinfection through legitimate business processes.

Pre-Defined Response Options

Three balanced response approaches with trade-offs:

Option A: Emergency USB Lockdown & Complete System Rebuild

Option B: Accelerated Parallel Response & Conditional USB Restoration

Option C: Selective Branch Isolation & Phased Security Recovery

Lunch & Learn Materials (75-90 min, 2 rounds)

Round 1: Discovery & Multi-Branch Assessment (30-35 min)

Investigation Clues:

Response Options:

Round 2: Customer Data & Regulatory Compliance (30-35 min)

Investigation Clues:

Response Options:

Round Transition Narrative

After Round 1 → Round 2:

The team’s initial response determines whether the bank faces immediate operational disruption (shutdown approach) or continued multi-branch worm propagation (monitoring/isolation approach). Either way, the situation escalates dramatically when Compliance Officer Robert Kim reveals that infected USB drives have accessed customer account databases containing personal and financial information for 125,000 customers. Federal banking regulations trigger strict notification timelines - 24 hours to regulators, 30 days to affected customers. This transforms the incident from an internal IT problem to a federal regulatory compliance crisis with potential customer trust and business impact. Additionally, threat intelligence reveals Raspberry Robin in financial institutions typically precedes ransomware attacks or fraud operations targeting customer data. A federal banking examiner calls requesting incident details, adding regulatory oversight pressure to the technical response. The team must now balance customer data protection, federal compliance, banking operational continuity, and multi-branch security coordination simultaneously under regulatory scrutiny.

Debrief Focus:

Full Game Materials (120-140 min, 3 rounds)

Round 1: Initial Discovery & Banking Network Impact (35-40 min)

Opening Scenario:

It’s the last business day of the month at Community First Bank, and all 45 branch locations are processing peak transaction volumes. Regional Director Janet Foster is reviewing month-end reports when her phone starts ringing with calls from multiple branch managers.

“The USB drives for our daily audit procedures are acting strange,” reports the downtown branch manager. “Files are appearing that look like folders - ‘Audit_Data’, ‘Transaction_Reconciliation’ - but they don’t open. And the systems are slower after we use the drives.”

As Janet starts investigating, similar reports flood in from branches across the region. The USB drives used for routine transaction reconciliation and audit compliance - drives that rotate between branches on a weekly schedule - are spreading infection faster than anyone realized was possible.

IT Security Manager Carlos Martinez convenes an emergency response team: “If this malware is spreading through our audit USB drives, and those drives visit multiple branches every week, we could have network-wide contamination within days. And month-end processing can’t afford any delays.”

Team Action: Each player takes 2 actions to investigate the incident using their role’s capabilities. The IM should track what the team discovers based on their investigation choices.

Investigation Discoveries (based on role and approach):

Detective-focused investigations:

Protector-focused investigations:

Tracker-focused investigations:

Communicator-focused investigations:

Key NPCs and Interactions:

Janet Foster (Regional Director):

Carlos Martinez (IT Security Manager):

Diana Chen (Branch Operations Manager):

Robert Kim (Compliance Officer):

Round 1 Pressure Events:

These occur during the 35-40 minute investigation period, building tension:

Round 1 Conclusion:

After investigations, the team should understand they’re facing multi-branch USB worm propagation through essential banking audit workflows, affecting customer account systems across distributed branch network, during critical month-end processing when regulatory compliance is paramount. Janet asks: “Based on what you’ve discovered, what’s your response strategy that protects our customers, maintains banking operations, and satisfies federal regulators?”

Round 2: Response Strategy & Federal Regulatory Pressure (35-40 min)

Situation Development:

The team’s initial response strategy meets the complex reality of distributed banking operations. If they chose USB shutdown, branches cannot complete federally required audits. If they implemented monitoring, worm propagation continues through shared USB drives. If they focused on isolation, customer data exposure expands to additional branches.

More critically, federal regulatory requirements and customer data protection obligations transform technical incident to compliance crisis.

Opening:

External threat intelligence from FS-ISAC: Raspberry Robin infections at financial institutions over the past year have led to follow-on ransomware attacks (LockBit, BianLian targeting banking systems) and data exfiltration for account fraud operations. “USB worm is initial access for sophisticated financial crime. Your customer account data is the ultimate target, and you’re in the threat actors’ pipeline.”

Simultaneously, Robert Kim completes customer data breach assessment: infected USB drives accessed account databases at 35 branches containing personal information (names, addresses, phone numbers, account numbers, transaction histories) for approximately 125,000 customers. “Under federal banking regulations - GLBA, state breach notification laws - we must notify regulators within 24 hours and customers within 30 days if unauthorized access occurred. The clock started when we discovered the compromise.”

Diana reports banking operations pressure: “Month-end reconciliation deadline is tomorrow. Without USB drives for audit data transfers, we’ll fail federal compliance requirements. Banking examiners will impose penalties for non-compliant audit procedures - potentially more severe than cybersecurity issues.”

Federal banking examiner calls: “We received automated alert from your systems about unusual activity. We need incident briefing including customer impact, remediation timeline, and notification procedures. Can you provide that today?”

Team Action: Each player takes 2 actions to develop comprehensive response strategy, considering:

Response Options and Consequences:

Comprehensive Multi-Branch Remediation:

Customer Protection Prioritized Approach:

FS-ISAC Collaboration & Federal Coordination:

Phased Branch Recovery with Customer Communication:

Emergency Federal Notification with Minimal Details:

Round 2 Pressure Events:

Building tension during response implementation:

Round 2 Conclusion:

Regardless of chosen approach, the team is managing intersecting banking challenges: customer data protection (federal regulatory requirement), operational continuity (month-end processing and audit compliance), multi-branch coordination (45 distributed locations), regulatory oversight (federal examiner involvement), and reputation management (customer trust and media attention). The incident has evolved from USB malware to comprehensive banking crisis requiring integration of security, compliance, operations, customer service, and regulatory relationship management. Janet states: “We need your recommendations. 125,000 customers, 1,200 employees, and federal banking regulators are all depending on us to make the right call.”

Round 3: Resolution & Financial Sector Security Lessons (35-40 min)

Final Situation:

Two weeks after initial discovery, the USB worm response is reaching conclusion. Depending on the team’s Round 2 response strategy:

If comprehensive remediation: All 45 branches cleaned of Raspberry Robin infection. Federal forensics determined customer data was accessed but no evidence of exfiltration. Breach notification sent to 125,000 customers and federal regulators. USB security controls implemented across banking network. No follow-on attacks occurred.

However, month-end audit compliance was failed, resulting in $150K regulatory penalties. Customer breach notification resulted in 3% account closure rate (3,750 customers, $45M deposits). Federal forensics and incident response costs totaled $350K. Some branches operated with reduced capabilities for 2 weeks. Federal examiners increased oversight intensity for next 12 months.

If customer protection prioritized: Customer-facing systems successfully protected throughout incident. Month-end processing completed maintaining audit compliance. However, administrative systems experienced follow-on attack 4 weeks later - attempted LockBit ransomware deployment (contained but required additional response). Customer breach assessment extended to 6 weeks creating notification timeline concerns with regulators.

The prioritization saved customer relationships and maintained banking operations but left security gaps risking additional incidents. Federal examiners questioned incomplete remediation approach.

If FS-ISAC collaboration: Financial sector intelligence sharing yielded valuable Raspberry Robin banking-specific remediation guidance. Core banking vendor support accelerated response by 40%. Federal examiner transparency resulted in accommodation for extended investigation before customer notification. Collaborative approach improved response quality.

External coordination costs $200K but preserved customer trust through managed communication. FS-ISAC participation strengthened industry reputation. Federal examiner relationship enhanced through proactive transparency.

If phased recovery: Staged remediation successfully balanced customer service with security restoration across 45 branches. High-volume branches remediated first minimizing customer impact. Month-end processing maintained through phased approach. Customer breach notification based on progressive assessment communicated confidence in thorough investigation.

Extended 4-week timeline kept some branches vulnerable but enabled continued banking operations. Federal examiners appreciated methodical approach but questioned vulnerability window. Demonstrated sophisticated multi-branch incident response.

If emergency federal notification: Preliminary notification satisfied 24-hour regulatory requirement. Extended investigation timeline revealed partial customer data exposure requiring notification to 85,000 customers (vs initial 125,000 estimate). Federal examiners accepted investigation rationale but scrutinized preliminary notification accuracy.

Customer notification delay created PR challenges when local media reported incident before official bank communication. Marketing/customer service challenges required significant damage control efforts.

Team Action - Part 1: Incident Closure (15-20 min):

Each player takes 1-2 actions to: - Complete any remaining technical remediation or validation - Finalize customer breach notification and federal regulatory reporting - Document lessons learned for banking security improvement - Present recommendations to bank executive leadership for USB security architecture

Team Action - Part 2: Financial Sector Security Learning (15-20 min):

The IM facilitates group discussion on banking cybersecurity lessons:

Facilitation Questions:

  1. “What makes financial sector cybersecurity different from other industries?”
    • Guide toward: Customer data protection primacy, federal regulatory compliance, operational continuity requirements, distributed branch networks, reputation/trust sensitivity
  2. “How do USB-based threats challenge distributed banking networks?”
    • Guide toward: Multi-branch propagation through shared devices, audit compliance creating USB dependency, branch coordination complexity, physical media bypassing network security
  3. “What role does federal regulatory compliance play in banking cybersecurity?”
    • Guide toward: Strict notification timelines (24 hours to regulators, 30 days to customers), examiner oversight, audit requirements, GLBA and state breach laws, regulatory relationship management
  4. “How should banks balance security and operational continuity?”
    • Guide toward: Customer service priorities, month-end processing requirements, audit compliance obligations, risk-based prioritization, branch coordination
  5. “What partnerships and resources are valuable for financial cybersecurity?”
    • Guide toward: FS-ISAC threat intelligence, core banking vendors, federal banking agencies (FDIC, OCC, Federal Reserve), legal counsel, forensics firms
  6. “How have USB threats evolved in financial services, and what does the future look like?”
    • Guide toward: USB as initial access for financial fraud and ransomware, supply chain USB compromise, BadUSB and firmware attacks, zero-trust approaches to removable media in banking

Victory Conditions Assessment:

Technical Success:

Business Success:

Learning Success:

Final Debrief Topics:

Financial Sector Security Challenges:

USB Threat Landscape in Banking:

Banking Incident Response:

Regulatory and Compliance:

Future Considerations:

Round 3 Conclusion:

Janet addresses the team: “You’ve navigated the unique challenge of banking cybersecurity - protecting 125,000 customers’ financial data while maintaining the operations they depend on, satisfying federal regulators with strict timelines, and coordinating security across 45 distributed branches. Banking isn’t like other industries - customer trust is our most valuable asset, and cybersecurity incidents directly threaten that trust. You’ve demonstrated the thoughtful, customer-centered, compliance-aware approach we need. Our customers and our regulators deserve nothing less.”

Advanced Challenge Materials (150-170 min, 3 rounds)

Additional Complexity Layers

For experienced teams seeking maximum challenge, add these complexity elements:

1. Federal Banking Regulatory Complexity

Multi-Agency Oversight:

Implementation: Introduce realistic banking regulatory complexity where different agencies have competing requirements. Make players navigate FDIC, OCC, and state agency notifications with varying timelines. Create tension between regulatory compliance speed and investigation thoroughness.

2. Customer Trust and Account Closure Crisis

Customer Impact:

Business Consequences:

Implementation: Introduce actual customer account closures and business relationship losses during scenario. Make players balance security thoroughness with customer communication and trust management. Create financial consequences beyond immediate incident response costs.

3. Multi-Branch Coordination Operational Complexity

Distributed Challenges:

Workflow Dependencies:

Implementation: Expand scenario to emphasize 45-branch distributed network complexity. Introduce branch manager resistance to security changes, geographic distance creating response delays, and workflow dependencies requiring careful coordination. Make players manage enterprise banking incident response with varying local conditions.

4. Core Banking System Vendor Dependencies

Vendor Constraints:

Vendor Communications:

Implementation: Make core banking vendor a critical stakeholder with significant control over remediation approaches. Introduce vendor approval requirements, response delays, and cost considerations. Create tension between bank’s desire for rapid response and vendor’s methodical approach.

5. Federal Banking Examiner Involvement

Examiner Oversight:

Regulatory Scrutiny:

Implementation: Add federal banking examiner as active stakeholder during incident response. Introduce examiner requests that consume management time, examiner questions about historical security practices, and potential enforcement action concerns. Make players balance incident remediation with examiner relationship management.

6. Customer Data Forensics Complexity

Breach Determination Challenges:

Notification Dilemma:

Implementation: Make customer breach determination genuinely ambiguous requiring difficult judgment calls with incomplete forensic evidence. Introduce notification strategy decisions with financial and regulatory consequences. Create pressure to notify quickly (federal 30-day timeline) versus investigating thoroughly (6-8 weeks for definitive forensics).

7. Local Media and Public Relations Crisis

Media Attention:

PR Challenges:

Implementation: Add media and public relations complexity alongside technical incident response. Introduce customer service pressure, legal/marketing conflicts, social media reputation damage, and executive communication demands. Make players balance transparent customer communication with legal/regulatory caution.

Advanced Challenge Round Structure

Round 1: Discovery Under Banking Constraints (45-50 min)

Players must investigate Raspberry Robin with: - Multi-agency federal regulatory requirements constraining disclosure and investigation approaches - Customer trust crisis with major account holder threatening to leave - 45-branch distributed network coordination challenges - Core banking vendor dependencies limiting investigation access and methods

Success requires: Balancing technical investigation with customer relationship preservation, navigating multi-agency regulatory landscape, coordinating across distributed branch network, working within core banking system vendor constraints.

Round 2: Response Under Financial Sector Complexity (45-50 min)

Players must develop response strategy while managing: - Federal banking examiner involvement and oversight during active incident - Customer data breach determination with forensic uncertainty - Multi-branch operational continuity during month-end processing - Vendor approval requirements and response timeline dependencies - Customer account closures and business relationship losses

Success requires: Financial sector-appropriate response balancing customer data protection, regulatory compliance, operational continuity, and business preservation. Multi-stakeholder management across customers, regulators, vendors, branches, and media. Creative problem-solving within banking regulatory and operational constraints.

Round 3: Resolution Under Banking Scrutiny (45-50 min)

Players must complete incident response while handling: - Customer breach notification strategy with forensic ambiguity - Federal examiner assessment and potential enforcement actions - Media relations and public reputation management - Long-term banking cybersecurity program development within vendor and regulatory constraints - Customer trust rebuilding and account retention initiatives

Success requires: Closure of complex banking incident addressing security, compliance, customer service, regulatory, reputational, and business dimensions. Strategic thinking about financial sector cybersecurity program evolution. Learning extraction about banking-specific security challenges and multi-stakeholder coordination.

Advanced Challenge Debriefing

Focus Areas:

1. Federal Regulatory Compliance Under Uncertainty:

2. Customer Trust and Reputation Management:

3. Multi-Branch Distributed Network Response:

4. Core Banking Vendor Partnership:

5. Banking Cybersecurity Program Maturity:

Victory Conditions (Advanced Challenge):